CVE-2012-1248

app/config/core.php in baserCMS 1.6.15 and earlier does not properly handle installations in shared-hosting environments, which allows remote attackers to hijack sessions by leveraging administrative access to a different domain.

• CWE-264

• http://basercms.net/security/1Vendor Advisory
• http://jvn.jp/en/jp/JVN53465692/index.htmlThird Party Advisory
• http://jvndb.jvn.jp/jvndb/JVNDB-2012-000043Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/53543Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75660Third Party Advisory, VDB Entry
• http://basercms.net/security/1Vendor Advisory
• http://jvn.jp/en/jp/JVN53465692/index.htmlThird Party Advisory
• http://jvndb.jvn.jp/jvndb/JVNDB-2012-000043Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/53543Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75660Third Party Advisory, VDB Entry

Published

May 15, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-1242Untrusted search path vulnerability in JustSystems Ichitaro …
• CVE-2012-1243The TwitRocker2 application before 1.0.23 for Android does n…
• CVE-2012-1244The NTT DOCOMO sp mode mail application 5400 and earlier for…
• CVE-2012-1245Cross-site scripting (XSS) vulnerability in the cleanup_urls…
• CVE-2012-1246Cross-site scripting (XSS) vulnerability in KENT-WEB WEB MAR…
• CVE-2012-1247Cross-site scripting (XSS) vulnerability in KENT-WEB WEB MAR…
• CVE-2012-1249The iLunascape application 1.0.4.0 and earlier for Android d…
• CVE-2012-1250Logitec LAN-W300N/R routers with firmware before 2.27 do not…
• CVE-2012-1251Opera before 9.63 does not properly verify X.509 certificate…
• CVE-2012-1252Cross-site scripting (XSS) vulnerability in RSSOwl before 2.…
• CVE-2012-1253Cross-site scripting (XSS) vulnerability in Roundcube Webmai…
• CVE-2012-1254Cross-site scripting (XSS) vulnerability in Segue 2.2.10.2 a…